Netwrix Auditor System Health Log - eventID 1076 / 1276

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the EventID and provides resolution.
Email It to Me Print this Page
Symptoms Netwrix Auditor 9.0 and above: The Netwrix Auditor System Health Log  contains EventID 1276.
Netwrix Auditor 8.5 and below: The Netwrix Auditor System Health Log contains EventID 1076.


EventID 1076 / 1276 may contain 4 error types:

Error type 1:
Unable to verify if SharePoint audit was configured correctly due to the following error: There was no endpoint listening at <Central_Administration_URL>/_vti_bin/
Netwrix/ConfigurationService.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details.

Error type 2:
Unable to verify if SharePoint audit was configured correctly due to the following error: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No connection could be made because the target machine actively refused it.)

Error type 3:
Unable to verify if SharePoint audit was configured correctly due to the following error: Cannot open database "SharePoint_Config" requested by the login. The login failed. Login failed for user 'username'.

Error type 4:
Unable to verify if SharePoint audit was configured correctly due to the following error: "The request channel timed out while waiting for a reply after 01:00:00. Increase the timeout value passed to the call to Request or increase the SendTimeout value on the Binding. The time allotted to this operation may have been a portion of a longer timeout.
Cause Review the possible error causes:

Error type 1:
This can be due to one of the following reasons:
  • At the time of Monitoring Plan (Managed Object in the versions older than 9.0) creation, the Netwrix Auditor license had expired, and the Netwrix Auditor Agent for SharePoint was removed.
  • The SharePoint Auditing feature was disabled for this Monitoring Plan (Managed Object), and the Netwrix Auditor Agent for SharePoint was removed.
Error type 2:
The SQL Server instance that hosts SharePoint configuration database is inaccessible.

Error type 3:
The SharePoint configuration database is offline, or the user acting as Farm Account does not have the required rights and permissions to access the configuration database.

Error type 4:

The timeout (1 hour by default) for the audit configuration operation has expired. This is most likely to happen on large SharePoint farms with over 20 thousand site collections
Resolution Depending on the received error type, follow the corresponding  resolution prompts:

Error type 1:
Check if your Netwrix Auditor license is valid and make sure that the Netwrix Auditor Agent for SharePoint has not been deleted from the computer that hosts SharePoint Central Administration.

Error type 2:
Make sure that the SQL Server that hosts SharePoint configuration database is accessible, and that the audited SharePoint farm is operational.

Error type 3:

Make sure that the configuration database is online, and that the Farm Account has the necessary rights to access the configuration database.

Error type 4:

Manually increase the SendTimeout value. Navigate to: %ProgramData%\Netwrix Auditor\Netwrix Auditor for SharePoint\Configuration\GUID*\service.config. 

​To view your monitoring plan (Managed Object in Netwrix Auditor 8.5 and below) GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your monitoring plan name in the configuration file:

-<n n="ManagedObjects">
....
<a n="Name" t="2" v="your_SharePoint_Managed_Object_name"/>
Was this information helpful?